General

  • Target

    9d3512c1635a67cfc4dd87c7a12e361f_JaffaCakes118

  • Size

    284KB

  • Sample

    240816-gqdqzaygmb

  • MD5

    9d3512c1635a67cfc4dd87c7a12e361f

  • SHA1

    932277e69ee648aafdacadf9bdca4f1246f9ca46

  • SHA256

    6c3a498158b5c884210afb416d669bf6cdec59363d36fbef4ef9dec891dba8de

  • SHA512

    d996928a601a079a1d0dd1f4586b4ed87f6ba14af56f3d7cc06346bea4f62600dc13d17f8807d2b1c6e15a28ac84ef21c563075dd3de41bdee0b02d4b59e0f1d

  • SSDEEP

    6144:ANH6qwy0iixyYE/92YR3zB80j7eWrpRx27/U:AYdXZxy6YR3zKSx27

Malware Config

Extracted

Family

gcleaner

C2

gcl-page.biz

194.145.227.161

Targets

    • Target

      9d3512c1635a67cfc4dd87c7a12e361f_JaffaCakes118

    • Size

      284KB

    • MD5

      9d3512c1635a67cfc4dd87c7a12e361f

    • SHA1

      932277e69ee648aafdacadf9bdca4f1246f9ca46

    • SHA256

      6c3a498158b5c884210afb416d669bf6cdec59363d36fbef4ef9dec891dba8de

    • SHA512

      d996928a601a079a1d0dd1f4586b4ed87f6ba14af56f3d7cc06346bea4f62600dc13d17f8807d2b1c6e15a28ac84ef21c563075dd3de41bdee0b02d4b59e0f1d

    • SSDEEP

      6144:ANH6qwy0iixyYE/92YR3zB80j7eWrpRx27/U:AYdXZxy6YR3zKSx27

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    • OnlyLogger

      A tiny loader that uses IPLogger to get its payload.

    • OnlyLogger payload

MITRE ATT&CK Enterprise v15

Tasks